diff --git a/epmet-module/data-aggregator/data-aggregator-server/src/main/java/com/epmet/dataaggre/controller/EpmetUserController.java b/epmet-module/data-aggregator/data-aggregator-server/src/main/java/com/epmet/dataaggre/controller/EpmetUserController.java
index f01ef8a3d4..bd535ae77c 100644
--- a/epmet-module/data-aggregator/data-aggregator-server/src/main/java/com/epmet/dataaggre/controller/EpmetUserController.java
+++ b/epmet-module/data-aggregator/data-aggregator-server/src/main/java/com/epmet/dataaggre/controller/EpmetUserController.java
@@ -1,6 +1,8 @@
 package com.epmet.dataaggre.controller;
 
 import com.epmet.commons.tools.annotation.LoginUser;
+import com.epmet.commons.tools.annotation.RequirePermission;
+import com.epmet.commons.tools.enums.RequirePermissionEnum;
 import com.epmet.commons.tools.exception.RenException;
 import com.epmet.commons.tools.security.dto.TokenDto;
 import com.epmet.commons.tools.utils.Result;
@@ -38,6 +40,7 @@ public class EpmetUserController {
      * @author sun
      */
     @PostMapping("stafflist")
+    @RequirePermission(requirePermission = RequirePermissionEnum.MORE_PATROL_RECORD_LIST)
     public Result<List<StaffListResultDTO>> staffList(@LoginUser TokenDto tokenDto, @RequestBody StaffListFormDTO formDTO) {
         ValidatorUtils.validateEntity(formDTO, StaffListFormDTO.Staff.class);
         if (!"patrolTotal".equals(formDTO.getSortCode()) && !"latestPatrolledTime".equals(formDTO.getSortCode())) {